Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8116 advisory.

    - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235
    - 1001-orabug36904359-CVE-2024-21131-fix.patch
    - 1002-orabug36904359-CVE-2024-21138-fix.patch
    - 1003-orabug36904359-CVE-2024-21140-fix-part1.patch
    - 1004-orabug36904359-CVE-2024-21140-fix-part2.patch
    - 1005-orabug36904359-CVE-2024-21140-fix-part3.patch
    - 1006-orabug36904359-CVE-2024-21144-fix.patch
    - 1007-orabug36904359-CVE-2024-21145-fix.patch
    - 1008-orabug36904359-CVE-2024-21147-fix.patch
    - CVE-2024-21131 Improve-UTF8-String-supports
    - CVE-2024-21138 Better-symbol-storage
    - CVE-2024-21140 Improved-loop-handling
    - CVE-2024-21144 Enhance-Pack-200-loading
    - CVE-2024-21145 Improve-2D-image-handling

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8120 advisory.

    - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235
    - 1001-orabug36904359-CVE-2024-21138-fix.patch
    - 1002-orabug36904359-CVE-2024-21138-fix.patch
    - 1003-orabug36904359-CVE-2024-21140-fix-part1.patch
    - 1004-orabug36904359-CVE-2024-21140-fix-part2.patch
    - 1005-orabug36904359-CVE-2024-21144-fix.patch
    - 1006-orabug36904359-CVE-2024-21145-fix.patch
    - 1007-orabug36904359-CVE-2024-21147-fix.patch
    - CVE-2024-21131 Improve-UTF8-String-supports
    - CVE-2024-21138 Better-symbol-storage
    - CVE-2024-21140 Improved-loop-handling
    - CVE-2024-21144 Enhance-Pack-200-loading
    - CVE-2024-21145 Improve-2D-image-handling
    - CVE-2024-21147 Improve-array-management

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12825 advisory.

    [4.1.6-9.0.1]
    - Fixes giflib CVE-2023-48161 issue [Orabug: 37178930]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8124 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8121 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8127 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8117 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8117 advisory.

    [1.8.0.432.b06-2.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:1.8.0.432.b06-1]
    - Update to shenandoah-jdk8u432-b06 (GA)
    - Update release notes for shenandoah-8u432-b06.
    - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version
    - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
    - Bump version of bundled zlib to 1.3.1 following JDK-8324632
    - Include backport of JDK-8328999 to update giflib to 5.2.2
    - Bump version of bundled giflib to 5.2.2 following JDK-8328999
    - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
    - Sync the copy of the portable specfile with the latest update
    - Resolves: RHEL-58791
    - Resolves: RHEL-62278
    - Resolves: RHEL-61285
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8124 advisory.

    [17.0.13.0.11-3.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:17.0.13.0.11-3]
    - Correct version suffix in 'Update to jdk-17.0.13+11 (GA)' changelog entry
    - Related: RHEL-58781

    [1:17.0.13.0.11-2]
    - Update to jdk-17.0.13+11 (GA)
    - Update .gitignore to ignore openjdk-17.0.13+11.tar.xz
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
    - Set buildver to 11
    - Set is_ga to 1
    - Update sources to openjdk-17.0.13+11.tar.xz
    - Resolves: RHEL-58781
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **

    [1:17.0.13.0.10-0.2.ea]
    - Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
    - Set rpmrelease to 2
    - Related: RHEL-58781

    [1:17.0.13.0.10-0.1.ea]
    - Update to jdk-17.0.13+10 (EA)
    - Update .gitignore to ignore openjdk-17.0.13+10-ea.tar.xz
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
    - Set buildver to 10
    - Update sources to openjdk-17.0.13+10-ea.tar.xz
    - Related: RHEL-58781

    [1:17.0.13.0.9-0.1.ea]
    - Update to jdk-17.0.13+9 (EA)
    - Update .gitignore to ignore openjdk-17.0.13+9-ea.tar.xz
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
    - Set buildver to 9
    - Set rpmrelease to 1
    - Set portablerelease to 1
    - Update sources to openjdk-17.0.13+9-ea.tar.xz
    - Related: RHEL-58781

    [1:17.0.13.0.1-0.4.ea]
    - Set rpmrelease to 4
    - Set portablerelease to 2
    - Related: RHEL-58781

    [1:17.0.13.0.1-0.3.ea]
    - Synchronize java-17-openjdk-portable.specfile
    - Set rpmrelease to 3
    - Related: RHEL-58781

    [1:17.0.13.0.1-0.2.ea]
    - Update to jdk-17.0.13+1 (EA)
    - Update .gitignore to ignore openjdk-17.0.13+1-ea.tar.xz
    - Synchronize java-17-openjdk-portable.specfile
    - Set updatever to 13
    - Set buildver to 1
    - Set is_ga to 0
    - Update sources to openjdk-17.0.13+1-ea.tar.xz
    - Related: RHEL-58781
    - Remove 0001-8332174-Remove-2-unpaired-RLO-Unicode-characters-in-.patch
    - Remove unicode section from rpminspect.yml, fixed instead by       https://gitlab.cee.redhat.com/osci/rpminspect-data-redhat/-/merge_requests/180       (OPENJDK-2904)
    - Related: RHEL-58781

    [1:17.0.12.0.7-3]
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
    - Set rpmrelease to 3
    - Set portablerelease to 4

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8124 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8117 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8127 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8121 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8121 advisory.

    [1:11.0.25.0.9-2.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:11.0.25.0.9-2]
    - Update to jdk-11.0.25+9 (GA)
    - Update release notes to 11.0.25+9
    - Switch to GA mode for release
    - Related: RHEL-58772
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **

    [1:11.0.25.0.8-0.2.ea]
    - Update to jdk-11.0.25+8 (EA)
    - Update release notes to 11.0.25+8
    - Related: RHEL-58772

    [1:11.0.25.0.7-0.3.ea]
    - RHJDKBP-875 - Added gating.yaml and/or rpminspect.yaml
    - RHJDKBP-874 - Remove
    - Related: RHEL-58772

    [1:11.0.25.0.7-0.1.ea]
    - Update to jdk-11.0.25+7 (EA)
    - Update release notes to 11.0.25+7
    - Related: RHEL-58772

    [1:11.0.25.0.6-0.3.ea]
    - Limit Java only tests to one 'jdk_test_arch'
    - Resolves: RHEL-59727
    - Related: RHEL-58772

    [1:11.0.25.0.6-0.2.ea]
    - Update to jdk-11.0.25+6 (EA)
    - Switch to EA mode
    - Update release notes to 11.0.25+6
    - Related: RHEL-58772

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8127 advisory.

    [1:21.0.5.0.10-3.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:21.0.5.0.10-3]
    - Sync the copy of the portable specfile with the latest update
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
    - Related: RHEL-61346

    [1:21.0.5.0.10-2]
    - Update to jdk-21.0.5+10 (GA)
    - Update release notes to 21.0.5+10
    - Bump giflib version to 5.2.2 following JDK-8328999
    - Bump libpng version to 1.6.43 following JDK-8329004
    - Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
    - Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
    - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
    - Sync with RHEL 7 portable build:
      - Use ExclusiveArch over ExcludeArch
      - pkgos definition needs to be early enough to be used in portablesuffix
    - Make build scripts executable
    - Sync the copy of the portable specfile with the latest update
    - Revert JDK-8327501 & JDK-8328366 backport until more mature.
    - Resolves: RHEL-58798
    - Resolves: RHEL-17186
    - Resolves: RHEL-61346
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8116 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of giflib installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-48161 advisory.

  - Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive     information via the DumpSCreen2RGB function in gif2rgb.c (CVE-2023-48161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8117 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8124 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8127 advisory.

    The OpenJDK 21 runtime environment.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8121 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8120 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0786-1 advisory.

  - A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger     an out of memory exception or denial of service via a gif format file. (CVE-2021-40633)

  - There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45.
    (CVE-2022-28506)

  - Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive     information via the DumpSCreen2RGB function in gif2rgb.c (CVE-2023-48161)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211962	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2024-8116)	Nessus	Oracle Linux Local Security Checks	high
211961	Oracle Linux 7 : java-11-openjdk (ELSA-2024-8120)	Nessus	Oracle Linux Local Security Checks	high
211364	Oracle Linux 7 : giflib (ELSA-2024-12825)	Nessus	Oracle Linux Local Security Checks	high
209701	RockyLinux 8 / 9 : java-17-openjdk (RLSA-2024:8124)	Nessus	Rocky Linux Local Security Checks	high
209688	RockyLinux 8 / 9 : java-11-openjdk (RLSA-2024:8121)	Nessus	Rocky Linux Local Security Checks	high
209683	RockyLinux 8 / 9 : java-21-openjdk (RLSA-2024:8127)	Nessus	Rocky Linux Local Security Checks	high
209681	RockyLinux 8 / 9 : java-1.8.0-openjdk (RLSA-2024:8117)	Nessus	Rocky Linux Local Security Checks	high
209305	Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2024-8117)	Nessus	Oracle Linux Local Security Checks	high
209304	Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2024-8124)	Nessus	Oracle Linux Local Security Checks	high
209288	AlmaLinux 9 : java-17-openjdk (ALSA-2024:8124)	Nessus	Alma Linux Local Security Checks	high
209287	AlmaLinux 9 : java-1.8.0-openjdk (ALSA-2024:8117)	Nessus	Alma Linux Local Security Checks	high
209286	AlmaLinux 9 : java-21-openjdk (ALSA-2024:8127)	Nessus	Alma Linux Local Security Checks	high
209284	AlmaLinux 9 : java-11-openjdk (ALSA-2024:8121)	Nessus	Alma Linux Local Security Checks	high
209264	Oracle Linux 8 / 9 : java-11-openjdk (ELSA-2024-8121)	Nessus	Oracle Linux Local Security Checks	high
209258	Oracle Linux 8 / 9 : java-21-openjdk (ELSA-2024-8127)	Nessus	Oracle Linux Local Security Checks	high
209251	RHEL 7 : java-1.8.0-openjdk (RHSA-2024:8116)	Nessus	Red Hat Local Security Checks	high
209170	CBL Mariner 2.0 Security Update: giflib (CVE-2023-48161)	Nessus	MarinerOS Local Security Checks	high
209167	RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2024:8117)	Nessus	Red Hat Local Security Checks	high
209161	RHEL 8 / 9 : java-17-openjdk (RHSA-2024:8124)	Nessus	Red Hat Local Security Checks	high
209160	RHEL 8 / 9 : java-21-openjdk (RHSA-2024:8127)	Nessus	Red Hat Local Security Checks	high
209158	RHEL 8 / 9 : java-11-openjdk (RHSA-2024:8121)	Nessus	Red Hat Local Security Checks	high
209118	RHEL 7 : java-11-openjdk (RHSA-2024:8120)	Nessus	Red Hat Local Security Checks	high
202290	RHEL 9 : giflib (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
202289	RHEL 8 : giflib (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196229	RHEL 6 : giflib (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196226	RHEL 7 : giflib (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191698	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : giflib (SUSE-SU-2024:0786-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-48161

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high